connect-manager: Ignore connectivity checks for incomplete checklists

This could cause a crash due to signature verification with missing
key (although, memcpy() likely just returns with length 0), but it
also makes the signature predictable as the key is omitted.

Fixes: d5cc175833 ("experimental P2P-NAT-T for IKEv2 merged back from branch")

src/libcharon/sa/ikev2/connect_manager.c

@@ -1398,6 +1398,14 @@ METHOD(connect_manager_t, process_check, void,
 		this->mutex->unlock(this->mutex);
 		return;
 	}
+	if (checklist->state == CHECK_NONE)
+	{
+		DBG1(DBG_IKE, "checklist with id '%#B' not ready yet",
+			 &check->connect_id);
+		check_destroy(check);
+		this->mutex->unlock(this->mutex);
+		return;
+	}
 
 	chunk_t sig = build_signature(this, checklist, check, FALSE);
 	if (!chunk_equals(sig, check->auth))